The role involves designing, building, and maintaining high-fidelity detections to identify malicious activity across infrastructure, applications, and cloud environments. The individual will develop detection logic based on adversary tradecraft and conduct hypothesis-driven threat hunts to uncover security gaps. Responsibilities include performing malware analysis and reverse engineering to inform detection strategies. The position requires building automation, data pipelines, and tooling to support scalable detection-as-code practices. Additionally, the role involves collaborating with various security teams to validate detections against real-world incidents and red team exercises.

Candidates must have at least five years of experience in detection engineering, threat hunting, or security operations. Proficiency in detection query languages such as SPL, KQL, EQL, YARA-L, or SQL and programming experience in Python is required. Applicants must demonstrate an understanding of adversary tradecraft and the ability to develop detections across network, endpoint, and cloud environments. Strong communication skills are necessary for documenting logic and presenting findings to various audiences. No specific degree or professional certification is listed as a mandatory requirement for this role.